Computers, phones, e-mail, badges, cameras and GPS can collect a great deal of data about employees. This lesson explains the Italian rules on remote monitoring and what the company and those who process data risk.
Remote monitoring of workers
Article 4 of the Statuto dei lavoratori (Law 300/1970, in the text in force today) distinguishes two cases.
1. Audiovisual systems and other tools that also make remote monitoring possible (for example cameras). They may be used only for organisational and production needs, safety at work and protection of company assets. To install them, an agreement with the trade-union representatives is needed (RSU or RSA; for companies with sites in several provinces or regions, with the most representative national trade unions). Without an agreement, the authorisation of the Ispettorato nazionale del lavoro (INL, the National Labour Inspectorate) is needed.
2. Tools the worker uses to carry out the work (computer, company phone, e-mail) and tools for recording access and attendance (badge). Here neither an agreement nor an authorisation is needed.
In both cases (paragraph 3) the data collected can be used for all purposes connected with the employment relationship, including disciplinary ones, only if the worker has been given adequate information on how the tools are used and how checks are carried out, and in compliance with the Codice privacy. Article 114 of the Codice refers back to Article 4 of the Statuto.
What this means for you
- An employee has the right to know which tools can record data about them and how it is used. The privacy notice or a company policy should explain it.
- Without the required information, the company cannot use that data against a worker.
- Blanket and continuous monitoring of e-mail or browsing conflicts with the principles of necessity and proportionality (see the Garante's guidelines on e-mail and the internet of 2007).
- In teleworking and smart working the employer must respect the worker's personality and moral freedom (Article 115 of the Codice).
- The Garante has repeatedly considered it disproportionate to record attendance by fingerprints and has fined companies and bodies that did so without a rule allowing it. The employees' consent is not enough.
If you administer these systems (IT, HR), you have no power to monitor a colleague on your own initiative: you may do so only according to the rules and the tasks assigned by the company.
The Garante and penalties
The Garante can, among other things, issue a reprimand, restrict or ban processing, order that data subjects' rights be met and impose administrative fines (Articles 58 and 83 GDPR). The maximum is 10 million euros or 2 % of worldwide annual turnover for the less serious infringements (for example security and breach notification) and 20 million euros or 4 % for the most serious (for example basic principles, lawful bases, data subjects' rights). In Italy the fines also apply to public bodies: the Garante has fined, for example, health authorities and municipalities (Article 166 of the Codice).
Anyone who suffers damage can claim compensation (Article 82 GDPR).
Offences
The Codice provides for criminal offences (Article 167 and following). Unlawful processing of data (Article 167) is punished by imprisonment from six months to one year and six months, or from one to three years for special category data, data on offences and unlawful transfers abroad. It is required that the act breach certain provisions of the Codice, be committed for profit or to harm the data subject and cause damage. There are also offences for the unlawful disclosure and fraudulent acquisition of data on a large scale (Articles 167-bis and 167-ter). Someone who sells customer lists, for example, answers personally, as well as on the disciplinary level.
What the employer still has to do
This course does not replace the controller's duties. The employer must still:
- designate in writing who processes data and give them instructions (Article 29 GDPR, Article 2-quaterdecies of the Codice);
- draw up privacy notices and keep the record of processing activities, where required;
- set internal procedures on access, retention, requests and breaches;
- regulate relations with external processors (Article 28), assess risks, carry out a data protection impact assessment where needed (Article 35) and appoint a DPO in the cases provided for.
The law does not prescribe any particular course or certificate. The employer decides what training its organisation needs.